Berlin launches probe after hackers release new batch of government login data

Berlin's authorities announced on Tuesday that they are investigating a fresh wave of data that appeared online, containing login credentials allegedly stolen from municipal systems.

The dump, posted on a public forum, includes usernames and passwords linked to various city services, ranging from internal administrative portals to citizen-facing applications. While the full extent of the breach remains unclear, officials confirmed that the information was not part of the earlier 2023 exposure that affected the capital.

City officials said they have engaged the Federal Office for Information Security (BSI) and have begun a forensic review of affected networks. The investigation aims to determine how the credentials were extracted, whether any unauthorized access occurred, and which systems may still be vulnerable.

Separately, the BSI issued a warning about the Rhysida cybercrime group, a loosely organized collective known for targeting European public institutions. The agency noted that Rhysida has been linked to multiple credential‑theft operations in the past year and that the recent Berlin leak appears to follow the group’s typical modus operandi of publishing stolen data to pressure victims into paying ransoms.

Cybersecurity experts say the incident underscores a growing trend of state and non‑state actors probing municipal infrastructures across the continent. As governments digitize more services, the attack surface expands, making city administrations attractive targets for financially motivated hackers.

For residents, the leak raises concerns about potential misuse of personal data, especially if the compromised accounts grant access to services that store sensitive information. Authorities have urged users to change passwords immediately and to enable two‑factor authentication where possible.

Berlin’s investigation is ongoing, with prosecutors indicating that any individuals identified as responsible could face severe penalties under German law. The city also plans to publish a detailed security advisory in the coming days, outlining steps citizens and municipal employees should take to mitigate risk while the technical response continues.